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An automatic test generation system has been developed to detect faults in 
combinational and sequential circuits. The circuit model treats logic cir- 
cuits as interconnections of unit- and zero-time-delay gates. A series of 
time-dependent Boolean equations are derived from the logic network 
(starting from the network inputs) in terms of sequences of signals (input 
vectors) on the circuit input leads. These equations account for the effect 
of specific circuit faults. Many tests, each consisting of a sequence of 
input signals (input vectors), are needed to detect all single faults in a 
circuit. Tests are generated from the time-dependent equations using two 
different strategies: (i) a maximum-cover approach to detect a large 
number of faults quickly by generating tests for the faults on the circuit- 
input leads. The fault-detection level achieved by the maximum-cover tests 
is then evaluated using fault simulation; (ii) tests for individual faults 
not detected by the maximum-cover approach. ATG has been implemented 
on the IBM 360, Model 67, and IBM 370, Model 168, computers. 

I. INTRODUCTION 

The automatic test generation system (ATG) was designed to 
provide fault-detection tests for single stuck-at faults in combinational 
and sequential circuits. Since this problem has essentially been solved 
for combinational circuits, 1-3 this paper concentrates on aspects of 
automatic test generation for sequential circuits. 

The ATG algorithms presented attempt to account for actual 
circuit behavior as closely as possible. Hence ( it is necessary to create 
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a computer model of the actual gates in the logic circuit. The circuit 
description used by ATG will utilize a unit/zero time-delay model, 
where a gate can assume one of three values: logical 0, logical 1, and 
don't-know X. This model has been widely used for logic-circuit 
simulation. 4 - 5 Because the test-generation algorithms described use the 
same model as many simulators, there are parallels between the 
simulation and test-generation techniques. These result from the effort 
to increase the accuracy of test generation to achieve the accuracy of 
current simulation techniques. 

The major drawback of previous algorithms 6-8 for test generation 
for sequential circuits is the lack of a satisfactory model for the 
sequential circuit. Previous algorithms use either the Huffman model 
or an iterative combinational circuit model for sequential circuits. 
While these models are mathematically convenient, they are hardly 
accurate representations of real logic circuits. The system to be 
presented here has the following features : 

(i) Requires no identification of feedback lines. 
(m) Allows gates to have time delays associated with their response 

to input stimuli. 
(Hi) Resolves races on flip-flops and detects circuit oscillations. 
(iv) Assumes that an unknown circuit state corresponds to each 

gate having the unknown value X. [The X corresponds to 

value 3 in Ref. (5).] 
(v) Generates a test for a single stuck-at or open-gate input fault, 

if it exists. The test is guaranteed to detect the fault (subject 

to the circuit-model assumptions). 
(vi) Handles gate-level models of sequential circuits containing up 

to approximately 1000 gates. 

For economy, the system allows test generation using two strategies. 
The first strategy (maximum cover) generates a set of tests designed 
to detect a large number of single faults without ever explicitly con- 
sidering a specific fault. The second strategy generates tests for speci- 
fied single faults. To allow rapid evaluation of the set of tests derived 
by the first strategy, a fault simulator is needed to simulate all single 
stuck-at faults. This simulator identifies the undetected set of faults 
that must be considered by the strategy-2 test generator. To keep the 
computation time reasonable, a user-specified parameter sets the 
maximum sequence length that will be considered by the system. The 
use and operation of the system is shown in the flow diagram in Fig. 1. 
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Fig. 1 — Overall strategy. 

II. MATHEMATICAL BASIS 

This section builds the framework for the remainder of the paper. 
The behavior of some gate G will be described by two equations G° and 
G 1 , where G° (G 1 ) describes the input conditions that set gate G = 0, 
(G = 1). The gates can assume one of three logical values: logical 0, 
logical 1, or the don't-know value X. Equations G° and G 1 , however, 
are strictly Boolean equations in that the constituent variables of G° 
and G 1 can assume only values of or 1. Similarly, G° and G 1 are 
Boolean variables. 

2.1 Definitions 

The following definitions are used in this discussion. 

(i) Input vector: A string of n logical values (0, 1, and X, where 
X is a don't-know value) that applied to the n corresponding 
input leads of a circuit. The effect of these values is allowed to 
propagate through the circuit before the next input vector 
is applied to the circuit. 

(it) Test: A series of input vectors applied in a specific order to 
the circuit inputs. A test is also sometimes called a sequence. 
The first vector in each test assumes the circuit is in a com- 
pletely unknown state. The nth vector (N > 1) assumes the 
state produced by the preceding N — 1 input vectors. Many 
tests may be required to detect all of the detectable faults in a 
logic circuit. Notice that it is not necessary to allow the circuit 
to stabilize between input vectors. 

(Hi) Sequence length : The number of input vectors in a test. 

(iv) Input variables : Associated with each circuit input lead a are 
two binary input variables a and a 1 . The variables a and a 1 
can each take on Boolean values and 1 (or "false" and 
"true"). Together, a and a 1 define the logical value (0, 1, or X) 
of input lead o as shown in Table I. Hence, if a = 1 (disallow- 
ing a" = a 1 = 1), then the logical value of lead a is 0. If 
a 1 = 1, then the logical value of lead a is 1. If neither a = 1 
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nor a 1 = 1, then the value of input lead a is unknown or X. 
It is clearly impossible for input lead a to simultaneously have 
a logical value of 1 and 0. Therefore, a = a 1 = 1 is an im- 
possible situation. The variables a and a 1 will often be used 
as an ordered pair (a 1 , a ). For example, (1, 0) represents the 
gate value of logical 1. 
(w) Sequence of input variables: Let a% (aH), i = 1, 2, •■-, 
represent the fact that a = (a = 1) during the t'th input 
vector of a sequence. If no subscript is used (e.g., a is written), 
then it is assumed that a represents the first input vector. 
(vi) Notation: As is traditional, "-f" represents logical or, and 
"•" represents logical and. The symbol " _ " will be used to 
represent not or complement. 
(vii) Unknown state: If the circuit is in an unknown state, it is 
assumed that each gate in the circuit is assigned the unknown 
output value X. 

2.2 Properties of the equations 

Some of the properties of input variables a and a 1 are described in 
this section. Consider a circuit consisting of a two-input and gate c 
with inputs a and b. Input leads a and b have associated with them 
(a 1 , a ) and (b 1 , b°), respectively. The problem is to compute (c 1 , c°). 
The usual truth table for and is shown below. 
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Translating this to the ordered-pair notation, we have : 



1480 THE BELL SYSTEM TECHNICAL JOURNAL, OCTOBER 1974 



AND 


(0,1) 


(a 1 , a") 
(1,0) 


(0,0) 


(0,1) 
(1,0) 

(0,0) 


(0, 1) 
(0,1) 
(0,1) 


(0,1) 
(1,0) 

(0,0) 


(0,1) 
(0,0) 
(0,0) 



(6 1 , ¥ 



Examining these ordered pairs, one finds that c° = 1 if and only if 
(iff) a = 1 or b° = 1. Similarly, c 1 = 1 iff both a 1 = 1 and b 1 = 1. 
Hence, the following relations hold for a two-input and gate c with 

inputs a and b : 

c o = a o _|_ &o 

C 1 = O 1 -^ 

or 

(c 1 , c°) = (a 1 ^ 1 , a° + 6°). (1) 

It is important to note that c° is not necessarily the complement 
of c 1 . For example, if (a 1 , a ) = (0, 0) and (ft 1 , 6°) = (1, 0), then 
(c\c°) = (0-1, + 0) = (0,0). 

A similar set of relations can be derived for a two-input or gate / 
with inputs d and e. 

' (/', /°) = (d l + e\ d°-e°). (2) 

The interpretation of this is that / = 1 if either d = 1 or e = 1 or 
both. Similarly, / = if both d = and e = 0. 

Another relation can be derived for the not gate (or inverter) h 
with input g as follows. Note that the complement of X is still X. 

(h\ h°) = (g°, <7 l ). (3) 

For later use, the relations governing the nand gate are also presented 
here. The nand gate is simply an and gate followed by a not gate. 
Hence, we have, for a two-input nand gate w with input y and z: 

«u>°) - (y° + z°,y 1 -z 1 ). (4) 

The above definitions have been presented for two-input gates. 
However, since the functions and and or are associative, the equations 
for an A/-input gate can easily be derived. For example, for a three- 
input nand gate w with inputs p, y, and 2, we have : 

(w\ w°) = (p° + y° + 2 , p l -y l -z l ). (5) 

Notice that since a and a 1 are binary variables, they obey all the laws 
of Boolean algebra. However, the interactions of a and a 1 are not so 
obvious and are of interest here. 
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It is significant that in the algorithms presented for computing the 
output equations for a gate [eqs. (1) through (5)], we have never 
produced a G°, G l , or G expression, where G is any gate in the circuit. 
This has occurred for two reasons. First, because gate G can assume 
three values G is not particularly useful. For example, if G = 1, then 
q = o + X. Second, as a practical matter, the computation of G° or 
G 1 , given G° or G l , is quite time consuming if both input and output 
are to be in sum-of-products form. 

2.3 Some identities and nonidentities 

After the operations and, or, and not have been defined, further 
properties can be investigated. By simple examination of the definitions 
for and, or, and not, the following identities are obvious. Let a 
represent any gate in the circuit. For ease of understanding, the 
corresponding theorem of Boolean algebra is written on the same 
line as the identities but enclosed in brackets. 

(i) (0, l)-(a\a°) = (0, 1) [0-a = 0]. 

(ti) (1, 0)- (a 1 , a") = (a 1 , a ) [1-a = a]. 

(in) (a 1 , a ) • (a 1 , a ) = (a 1 , a ) [a-a = a]. 

(iv) (1, 0) + (a 1 , o°) = (1, 0) [1 + a = 1]. 

(v) (0, 1) + (a 1 , a") = (a 1 , a ) [0 + a = a]. 

(vi) (a 1 , a ) + (a 1 , a ) = (a 1 , a ) [a + a = a], 

(m) (a 1 , a ) • (b 1 , 6°) = (6 1 , 6°) • (a 1 , a ) [Commutative]. 

Proof: (a\ a ) ■ (b\ b°) = (a 1 • b 1 , a + b°) 

= (b l -a\ b° + a ) = (b 1 , 6°)- (a 1 , a ) QED. 

Similarly, 

(mil) (a 1 , a ) + (b 1 , 6°) = (b\ b°) + (a 1 , a ) [Commutative]. 

(iaO [(a 1 , a°) • (b 1 , b°)] • (c 1 , c°) = (a 1 , a ) • [(b 1 , b°) • (c 1 , c»)] 

[Associative]. 

Proo/ : [ (a 1 , a ) • (b 1 , b°) ] • (c\ c°) 

= ([a^b 1 ]^ 1 , [a° + b°] + c°) 
= (^-[b'-c 1 ], a° + U>o + c°l) 

= (a 1 , a°)-[(bS b»).(cS c )] QED. 

Similarly, 

(i) [(a 1 , a") + (b 1 , b»)] + (c\ c°) 

= (a 1 , a ) + [(b 1 , b°) + (c 1 , c )] [Associative]. 

(a») (a 1 , a ) • (b 1 , b°) + (a 1 , a ) = (a 1 , a ) [ab + a = a]. 
1482 THE BELL SYSTEM TECHNICAL JOURNAL, OCTOBER 1974 



Proof: (a l ,a°)-(b l , b°) + (a 1 , a ) 

= (a l -b\a° + b°) + (a 1 , a ) 

= (a 1 -ft 1 + a 1 , [a + 6°]-a°) 

= (a 1 , a + a°b°) = (a 1 , a ) QED. 
(sit) a - a 1 = a 1 -a = 0. 

This is obviously true if a is a circuit input lead. Because the 
computation of the equations proceeds from gate inputs to 
gate outputs, this result can be shown inductively. For any 
valid circuit state (gates have logical values 0, 1, or X), the 
theorem is true. It is also true for input leads, as mentioned 
earlier. Then, by examination of eqs. (1) through (5) above, 
we see that the relationship is preserved when the new gate 
output equations are computed. Hence, by induction, it 
follows that the relationship holds for every gate in the circuit. 



(xiii) [(a 1 , a°)-(b\ 6°)] = (a , a 1 ) + (b°, b 1 ) [(a-6) = a + 6]. 

Proof: [(a 1 , a°)-(b\ 6°)] = (a 1 • 6 1 , o° + 6°) 

= (a + b°, a'-b 1 ) = (a , a 1 ) + (b°, b 1 ) QED. 



(xiv) [(a 1 , a ) + (b\ 6°)] = (a , a l )-(b°, 6»)[(a + b) = a-b~J 

Proof: [(a 1 , a ) + (6 1 , 6°)] = (a 1 + 6 1 , a -6°) 

= (a°-b°, a 1 + 6 1 ) = (a , a 1 )- (6°, & 1 ) QED. 

Again, it is clear that identities (xiii) and (xiv) can easily be 
extended to several variables (e.g., (a-b-c) = a -\- 6 + e). 
These are simply DeMorgan's theorems. 

The identities above simply follow the Boolean algebra. The follow- 
ing set of nonidentities results primarily from the three values used to 
model the gate behavior. 

(i) a + a 1 9* 1. 

Proof by example: (a 1 , a ) = (0, 0). 

Clearly, ^ 1. 

This is not unexpected since the only relation between a and 

a 1 is that a -a 1 = 0. 

(ii) (a 1 , a ) • (b\ b°) + (a 1 , a ) • (b°, b l ) ?± (a 1 , a ) [a-6 + a-6 ^ a]. 
(Hi) a-c + a-b-c 9^ b-c + a-c. 
(iv) ab 4- a-c + b-c 9^ a-b + a-c. 

Nonidentities (ii), (Hi), and (iy) are easily proved by examining 
the truth tables, where the variables are allowed to assume three 
values: logical 0, logical 1, and the don't-know value X. 
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It is interesting to note that if we required the circuit input leads 
to have only values and 1, the system presented here would reduce 
to Boolean algebra with a = a 1 and a 1 = a . This is a reasonable 
restriction, since we could always require that any X values generated 
for the input leads be arbitrarily set to logical or 1. However, it 
would then be necessary to treat input leads differently from other 
gates in the circuit, since it is clearly not possible to force every gate 
in the circuit to a known value (logical or 1). Hence, the generality 
of allowing circuit input leads to assume the value X is retained in 
this paper and all gates are treated identically. 

III. EQUATION DERIVATION FOR LOGIC NETWORKS 

The operation of the ATG has two well-defined steps. The first 
step is to derive a set of relations (equations) that represent the 
behavior of the logic circuit. The second step is to derive a set of tests 
for the circuit based on the equations derived in the first step. In this 
section the equation-derivation process is described. 

The equation derivation process essentially reduces the behavior of 
a logic circuit to a series of equations. Hence, this reduction process is 
quite critical. These equations must reflect the true circuit behavior as 
closely as is possible (or economical). This means that the time delay 
of gates must be accounted for during the equation-generation process. 
The equation-generation process will first be presented using a fault- 
free, unit/zero, time-delay model for each gate. The model will then 
be extended to account for single stuck-at-one and stuck-at-zero faults. 

The method is essentially a dynamic equation-generation process 
that determines exactly those input sequences that will force each 
gate to a logical or 1 at each instant of time. The equation-derivation 
process begins with the circuit inputs and continues through the circuit 
until the equations are stable; that is, until the output equation on 
each gate is consistent with the input equation on that gate. The 
equations are derived in terms of circuit input variables only; no 
feedback lines need be identified. The input variables may change 
several times before the circuit finally reaches a stable state. 

Since the objective is to generate tests to detect faults in a circuit, 
the result of this process will be a series of logical values 0, 1, and X 
(don't know) to be applied to the input leads of the circuit. The output 
of the circuit will then be observed to determine which classical faults 
have been detected. That is, the output of the real (perhaps faulty) 
circuit will be compared to the expected result to determine if the 
real circuit is performing correctly. 
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3.7 Fault-free-equation derivation 

In this section, the problem of generating equations that represent 
the behavior of the fault-free circuit is discussed. Because certain 
simplifications are possible, the equation-derivation process for com- 
binational circuits is discussed first. This is followed by the equation- 
derivation process for sequential circuits. 

3.1.1 Equation derivation tor combinational circuits 

The derivation of the fault-free equations will be considered here. 
Consider the nand gate G shown in Fig. 2. If we assume both inputs 
to the gate are circuit inputs or other gate outputs, then we have: 

G° = A l -B l 
G l = A° + B°. 

Equation G° denotes exactly those input conditions to gate G that 
force (or set) gate G to logical 0. Implicit in this equation is the unit- 
delay assumption. If inputs A = 1 and B = 1 are applied at time t, 
then the output of G is forced to logical at time t + 1. A similar 
situation exists for G l . Either A = or B = (or both) applied at 
time t to the inputs of G forces its output to be logical 1 at time t -\- 1. 
This is similar to eqs. (1) through (5) in the previous section, except 
that the element of time has been added. For most gates, the output 
of the gate responds to the input stimuli one unit of time later. The 
gates with one unit of delay are "real" gates, e.g., those containing an 
active semiconductor device. 

In some logic families it is possible to directly connect two (or more) 
gate output leads together. This connection (called a tic here, for 
tied collector) performs a logic function. If the ground level is logical 0, 
then the tic function is and. If the ground level is logical 1, then the 
tic function is or. The tics may be considered zero-delay gates except 
for the wire-propagation delay, which is not considered here. 

If computation begins at the circuit inputs, which are assumed to be 
applied at time t, the output of each gate driven by a primary input is 
reevaluated and the new equation is assigned to the gate output at 
time t + 1. Every gate whose input equation changed at time t + 1 
is reevaluated and its new output is assigned at time t -\- 2. This 
process continues until the computation reaches the circuit output 



|A°. A') 
<B°, B 1 ) 



> 



G° = A' . B' 
G 1 = A° + B° 



Fig. 2 — Equations based on input equations. 
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gates. At any time t + t after the processing begins, the equations 
denote those input conditions that force each gate to logical and 1 
at * gate delays after application of the vector. In particular, when the 
circuit has settled to a stable state, the input values that set each gate 
to logical or 1 are specified. Notice that no assumptions have been 
made that would preclude the application of this argument to sequen- 
tial circuits. 

The similarity between this procedure and the actual propagation 
of electrical signals through the circuit should be evident. In both 
cases, the input stimuli are applied to the circuit inputs and are allowed 
to propagate through the circuit. 

3.1.2 Equation derivation for sequential circuits 

Three points are significant in the discussion of equation derivation 
for combinational circuits: (i) the process assumes all gates have 
either unit or zero delay, (it) the process starts from the circuit inputs 
and proceeds through the circuit much as a signal would propagate 
through the circuit, and (tit) the equations define, for each time t + t, 
exactly those input conditions that cause each gate in the circuit to 
be forced to logical and 1 at that time from the specified initial 
state. Again, there are no assumptions that limit this technique to 
combinational circuits. 

The primary addition, which must be made to allow the same 
algorithm to be applied to sequential circuits, is some provision for 
deciding when to stop the computation. For combinational circuitry, 
the computation stops when the circuit outputs are reached. However, 
this is not satisfactory for sequential circuits. The equation derivation 
yields G° and G 1 for each gate G for each time t + t. If both G° and 
G l at time t + t are equal to G° and G 1 at time t + i + 1, the gate is 
in a stable state. Otherwise, each gate driven by gate G must be 
reevaluated since G changed values (output equations). A detailed 
flow chart of the equation computation process will be presented later. 

Let o.t represent the value of circuit input lead a during the t'th 
vector of the test (or sequence). Similarly, a°i (aH) means make input 
lead o logical (logical 1) during the tth input vector of the sequence. 
The first vector in each sequence is number one. If the sequence 
number is missing, then it is assumed to represent the first vector of 
the sequence. An example of the application of this algorithm is 
shown in Fig. 3 where the equations for a flip-flop are calculated. Time 
runs down the page. The flip-flop is assumed to start from the unknown 
state since F° = F l = G° = G 1 = 0. The inputs are assumed to be 
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Fig. 3 — Equations for nand flip-flop from an unknown state. 

applied at time t. At time t + 1, only F 1 and G 1 changed values so at 
time < + 2 only G and F° are calculated. At time t + 3, none of the 
new output equations changed, so the circuit is stable and computa- 
tion stops. 

A similar computation can be carried out if the circuit is in some 
known initial state. This is illustrated in Fig. 4 where the circuit is 
initially set at F = (F° = 1, F 1 = 0) and G = 1 (G° = 0, G 1 = 1). 

The above procedure finds the next state function for a combina- 
tional or sequential circuit. That is, given a circuit state (possibly 
unknown), we can find all possible next states resulting from the 
application of one input vector. 
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Fig. 4 — Equations from F = 0, G = 1 state. 
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Clearly, the problem is to determine the state of the circuit as the 
result of each possible sequence of vectors. If this can be done, then 
there is no need to select a particular next state since they are all 
considered simultaneously. A method for doing this is described in 
the next section. 

3.7.3 Sequence derivation tor sequential circuits 

The algorithm for sequence derivation is based only on the input 
behavior of the circuit. There is no need to consider any feedback 
variables. Again, the derivation assumes either unit- or zero-delay gates. 

This algorithm is based on the explanation presented in the previous 
section. The derivation proceeds as follows for a sequence of length M. 

(i) To the circuit inputs [a, b, c, •••] = / apply the variables 
[a*l, 6*1, c*l, • • •] = 1. 1 (a* means apply a 1 or a ) and derive 
the equations for the circuit (starting from any initial state). 

(u) Let j = 1. 

(Hi) From the circuit "state," as defined by the application of the 
input vector of variables I.j = [a*j, b*j, c*j, • • ■], apply the 
input vector of variables I.j + 1 and propagate these variables 
through the circuit, i.e., derive the "equations" for the circuit 
in terms of I.j + 1 and I.k for all k < j. The effect of I.j 
need not stabilize before applying I.j + 1. 

(iv) If j < M, then let j = j + 1 and go to step (in). Otherwise, 
exit. 

This procedure models the behavior of a logic circuit. The input 
stimuli (variables) are applied to the inputs of the circuit and allowed 
to propagate through the circuit. The input vector 1. 1 assumes the 
circuit is in some initial state, which is probably unknown. Input 
vector 7.2 produces equations from the initial state produced by 1. 1. 
In general, the vector I.j starts from the state produced by all I.k 
where k < j. 

After application of I.j, the effect on the circuit of any sequence of 
j vectors is known. This is obvious since we have already shown that 
the application of 7.1 from any state produces the equations G° and 
G 1 for every gate in the circuit as a result of 1. 1. This extension makes 
the initial state for I.j, j ; ^ 2, a function of all j — I vectors. 

An application of this algorithm is shown in Figs. 3 and 5 for the 
nand flip-flop. Here I.j = (a*j, b*j) and the sequence derivation is 
carried out for sequences of length 2 or less. Figure 3 represents 
sequences of length 1. Figure 5 represents sequences of length 2. The 
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Fig. 5 — Result of second vector of sequence. 

computation for sequences of length 2 in Fig. 5 begins from the final 
state of the computation for sequences of length 1 shown in Fig. 3. 
To illustrate the interpretation of the equations, consider the final 
state of G° = a°2-b l 2 + a'l-Wl-bV shown in Fig. 5. This means that 
the sequence of length 1, a = and 6 = 1 (for a°2 • 6*2), or the sequence 
of length 2, a = and 6 = 1 followed by a = X and 6 = 1 (for 
o°l -6 l l -b l 2), will set gate G to logical 0. 

3.7.4 Equation race analysis 

A race occurs on the simple two-NAND-gate flip-flop shown in Fig. 3 
when the output state of the flip-flop is unpredictable from the input 
conditions. Under these circumstances, the outputs of the flip-flop 
must be set to the unknown value X. Let us examine F° = 6°1 • a'2 and 
G° = a°l-b l 2 at time t + 4 in Fig. 5. Since F°-G° 5* 0, then both 
6°1 • a l 2 and a°l • 6 X 2 could be simultaneously applied to the circuit 
inputs producing the sequence a°l • 6°1 • a}2 • 6 J 2. This represents the 
application to the flip-flop of the sequence a = and 6 = followed 
by a = 1 and 6 = 1. This produces the race state (unpredictable 
output conditions) for the nand flip-flop and must therefore be 
eliminated. The race state for our example isa = 6 = F = G=lat 
some time t. If a race occurs, the values computed and saved for time 
t + 1 are F = G = 0. In addition, when unknown states are allowed, 
a race is also declared if F = and G = X or F = X and G = at the 
same instant of time. 6 This implies that when F = 0, G cannot be 
or X. Thus, to eliminate races, it is necessary to demand that if F = 
then G = 1 and, similarly, if G = then F = 1 at the same instant 
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of time. This is accomplished in our example by forming the new 
equation F°n at time t + 4 as F°n(t + 4) = F°(t + 4)-G 1 (< + 4) 
= an ■ a>2 • 6°1 + a x 2 • 6°1 • 6°2. Similarly, G°n {t + 4) = a°l • a°2 • 6*2 
+ a°l • 6 1 2-6 1 1. This process is called race analysis since it prevents the 
equations from causing simple flip-flops (basically, two cross-coupled 
nand or nor gates) to race. 

Race analysis must be performed at time t if both F° and G l changed 
at time t, where F and G are the two gates in a simple flip-flop. While 
this result is shown here for the nand flip-flop, the proof can easily be 
extended to nor flip-flops. The primary difference is that F 1 and G 1 
must be modified for nor flip-flops while F° and G° must be modified 
for nand flip-flops. 

(i) If F° does not change, then gate F cannot change to logical 

at time t; therefore, there can be no race. 
(it) If G 1 (see Fig. 5) does not change at time t, then F°(t) was 
formed by ANDing together G l (t — 1) and a}(t — 1). That is, 
F°(t) = G*(t - l)-a l (t - 1). But G l (t - 1) = G l (t) by as- 
sumption. Race analysis would form 

F°n(t) = F°(t)-G l (t) = F^fi-G^t - 1) 
= a l (t - 1)-G l (t- 1)-G l (t - 1) 

= a l (t- l)-&(t- 1) = F°(t). 

Therefore, the new F°n resulting from race analysis is the same 
as the original F°. Then, there can be no race. 

Earlier it was shown that F°-F 1 = for any gate F at any time. 
It is easily seen that race analysis does not destroy this property 
since, if F^-F 1 ^) = and F°n(t) = F^-G^t), then F^n^-F^t) 
= F^D-G'iD-F'it) = 0. 

3.1.5 Equation oscillations 

It is possible that the equation computation process will never 
terminate. That is, the old equations on some gate are always different 
from the new equations on that gate. This situation is known as 
equation oscillation. If the computation described in Section 3.1.3 
proceeds through an arbitrary number (user declared) of timing lists, 
then an oscillation is declared and the message "equation oscillation" 
is printed for the user. 

An example of an oscillation is shown in Fig. 6. In general, the 
objective is to stop the oscillation by selecting a stable set of equations. 
This can usually be done by setting the new equation on an oscillating 
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Fig. 6 — Equation oscillation. 

gate, say F°(t) equal to F°(t)-F°(t - 1). This is intended to force the 
equations on gate F to stabilize by generating equations that make 
F°(t) = F°(t — 1). This technique is not guaranteed to resolve all 
oscillations. 



3.7.6 Complete description of equation derivation 

The complete algorithm for generating the equations for a sequential 
circuit is shown in Fig. 7. Only two parts of the flow chart have not 
been explained previously in this section. One of these parts is the 
method of handling the zero-delay gates. The output of all the zero- 
delay gates are calculated before the next list of unit-delay gates is 
processed. These output equations are assigned to the zero-delay gates 
immediately. 

The remaining unexplained part is the initial-state pass. This pass 
simply examines the circuit and propagates forward (before the input 
variables are applied) the effect of any gates set to logical or 1 and 
any faults. For example, if gate G drives gate H and gate G is set to 
logical 0, this pass determines that the output of H should be logical 1. 

This completes the description of the equation-generation process for 
fault-free sequential circuits. Next, the algorithm for generating the 
equations for a sequential circuit in the presence of a single fault is 
described. 
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Fig. 7 — Equation computation flow chart. 

3.2 Equations containing faults 

Equations for circuits containing faults may be derived in a way 
similar to those used for fault-free circuits. This method allows tests 
to be generated that can detect a specific fault. For efficiency, it is 
possible to consider several single faults simultaneously. The single 
faults considered here are the gate outputs stuck-at-one and stuck-at- 
zero as well as gate inputs open (e.g., open diode or emitter). The input 
open on a nand or and gate will be treated as stuck-at-one while the 
input open on a nor or or will be treated as stuck-at-zero. 

Let the variables xH and xH represent fault variables. Let xH mean 
the fault x.i is present in the circuit. Similarly, xH means the fault is 
not present in the circuit. For the fault variables, the i does not 
represent the t'th vector in a sequence; rather, it represents the ith 
fault being considered. (Faults are always denoted by x.i and the 
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associated variables by xH or xH.) Since the single faults are assumed 
to be permanent, any fault x.i will be present during the entire test 
sequence. The two states for x.i allow the comparison of the faulty 
and fault-free circuit behavior to derive a test to detect the presence 
or absence of the fault in the circuit. 

Consider the gate shown in Fig. 2. The fault-free equations are 
shown. If, however, the input-open fault on gate G from A is being 
examined, then the equations for gate G are shown in Fig. 8a. It is 
possible to set gate G to logical either by applying A 1 and B 1 in the 
presence or absence of fault x.i or by applying B 1 in the presence of 
fault x.i. It is also possible to set G to logical 1 by applying B° in the 
presence or absence of fault x.i or by applying A in the absence of 
fault x.i. Similar analysis for the output stuck-at-zero fault x.S and 
the output stuck-at-one fault xA can easily be performed in the 
manner shown in Figs. 8b and 8c. 

Now assume there is only one fault in the circuit and consider the 
case where the fault propagates around a loop and returns to the 
site of the failure. If the fault is the input open on gate G from A, 
then the equations shown in Fig. 8a can be rewritten as shown in 
Fig. 9a where fault x. 1 is explicitly considered and D, E, F, ■ • ■ repre- 
sent sum-of-products equations. Computing G° and G 1 yields the 
equations shown in Fig. 9a. Figure 9b considers the case where the 
fault exists (x i l) and Fig. 9c considers the case where the fault does 
not exist (.t°1). Comparison of Figs. 9b and 9c with 9a shows that the 
computations proposed in this section for combinational circuits are 
also applicable to sequential circuits for the input-open case. 

A similar analysis can be carried out for the gate output stuck-at-one 
and the output stuck-at-zero faults. This demonstrates that the 
equations shown in Fig. 8 for handling faults in combinational circuits 
are also applicable to sequential circuits. 



X.1 
A-K- 



GO = a 1 . B 1 + X'l . B 1 
G 1 = A° . X°1 + B° 



(a) INPUT OPEN FAULT EQUATIONS 



A 



— I V£ G . A , . B i ♦ X-3 a— | \J" 

1 y ^ G 1 - A° . X°3 ♦ B° . X°3 B 1 J ^ 
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B 1 J G 1 = A° . X°3 * B° . X°3 B 1 J ~ G 1 = A° + B° + x'4 

(b) OUTPUT STUCK-AT-ZERO EQUATIONS (c) OUTPUT STUCK-AT-ONE EQUATIONS 

Fig. 8 — Equations for handling faults in combinational circuits. 
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Fig. 9 — Equations for handling faults in sequential circuits. 

3.3 The halting problem 

One problem that must be discussed is how to determine when 
sequences of sufficient length have been generated. That is, given the 
equations that represent sequences of length N and the equations that 
represent sequences of length N + I, will more information be gained 
by generating sequences of length N + 2? The question is answerable 9 
if the feedbacks have been identified ; however, the maximum sequence 
length contains factors of the form 2 to the power m, where m is the 
number of circuit inputs. For 500-gate, 40-input circuits, this is an 
absurd number. 

There does not appear to be any practical method of determining 
when to halt the equation-generation process. In practice, the maxi- 
mum sequence length to be considered is supplied by the user. The 
usual procedure is to start with sequences of length 1 and increase the 
sequence length until an acceptable level of undetected faults remains 
using the test-generation schemes presented in the next section. As 
might be expected, the run time increases significantly with increasing 
sequence length such that, even if it were simple to determine when 
to halt, it would probably not be economical. In practice, the halting 
problem has presented no difficulties. It is, however, an interesting 
theoretical problem. 

In practice, the maximum sequence length required to detect all 
faults in the circuit provides some measure of the ease with which 
the circuit can be tested. The shorter the sequence length required, 
the more easily the circuit can be tested. This fact could be used as a 
circuit-design constraint by requiring that all circuits be testable with 
sequences of N or less where N is small. In fact, a 1000-gate, 11-state 
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sequencer was designed so that the flip-flops representing the state 
could be written and read directly from circuit inputs and outputs. 
This produced an easily testable sequential circuit. 

3.4 Clocked circuits 

The algorithms that have been presented allow the circuit input 
leads to be treated as variables [e.g., (a 1 , a )] or as logical values 
where logical is (0, 1) and logical 1 is (1, 0). It is possible to allow 
some circuit inputs to be represented by variables and others by 
logical values. Clearly, it is possible to change the logical values 
between logical and 1 . Then we have the ability to apply a sequence 
of logical values to an input lead. 

For example, suppose the circuit being considered has a clock lead 
whose normal operating waveform is 1-0-1-0 and all other input 
leads are static during this cycle. Then it is possible to apply variables 
to all but the clock lead and to supply the waveform (1,0) — (0, 1) 
— (1, 0) — (0, 1) to the clock lead. In this way, ATG does less work 
since we have considered a sequence of length 4 on the clock lead and 
sequences of length 1 on all other leads. This is considerably more 
economical than computing sequences of length 4 over all input leads. 

In a similar way, user-specified initialization sequences can be 
applied to the circuit to place it in some desired state before allowing 
ATG to select the next input sequence. This is an effective way of 
using ATG. 

3.5 Self-initializing circuits 

Certain classes of sequential circuits are self-initializing in that, 
regardless of the initial state, the circuit always assumes a known 
state when power is applied. A simple example of such a circuit is 
shown in Fig. 10. Because the flip-flop always initializes to C = 0, 
D = 1 or C = 1, D = 0, gate F will always be logical forcing the 
flip-flop to the C = 1, D = state. 




Fig. 10 — Self-initializing circuit. 
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If this circuit is assumed to be in an unknown state (B = C = D 
= e = F = X), then because X = X, the basic ATG algorithm does 
not determine the required initial state. The operation of ATG requires 
that gates be forced to some initial state by the application of input 
vectors from some initial state. Hence, self-initializing circuits require 
that the proper initial state be specified by the user. This has not 
proved to be a problem in practice since most circuits contain ini- 
tializing leads. 

IV. TEST GENERATION FROM THE EQUATIONS 

Two different schemes for generating tests are described in this 
section. The first scheme described is the generation of tests to detect 
single faults, where the equations are derived in terms of these faults. 
However, in a 500-gate, 2000-fault circuit it is not economical to attack 
all 2000 faults on a one-at-a-time basis. The second method for test 
generation is aimed at detecting large numbers of faults as easily as 
possible. It attacks the problem by essentially attempting to detect 
the stuck-at-one and stuck-at-zero fault at each circuit input lead by 
observing each circuit output lead. This is called the maximum-cover 
strategy. This scheme typically detects around 90 percent of the 
classical faults if the equations reasonably describe the circuit — that 
is, if the sequence length used is long enough. 

4.1 Generating a test to detect a fault 

To detect fault x.i, it is necessary to select a test (input sequence) 
that will force some output of the circuit to have the value k for 
k — 0, 1 in the presence of the fault x.i and to have the value k in 
the absence of fault x.i starting from the given initial state. Let one 
output gate G of a circuit have the following equations (by simple 
factoring) : 

G° = A +B-xH + C-xH . 

G 1 = D + E-xH + F-x°i, 

where A, B, • ■ -, F are also sum-of-products expressions. This means 
that the terms in A(D) are the only terms that set G = (G = 1) 
regardless of the presence or absence of fault x.i. The tests to detect 
fault x.i at gate G are given by BF + C-E. This is proven as follows. 
Since the fault either exists or does not exist, xH-xH = 0. First 
consider the case in which k = 0. Since G^G ) represents exactly those 
conditions that set G = 1 (G = 0), then G l {xH = 1) = D + F repre- 
sents those conditions that set G = 1 in the absence of fault x.i. Simi- 
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larly, G°(x l i = 1) = A + B represents those conditions that set 
G = in the presence of the fault. Hence, every condition (input 
vector) that makes the good output of G = and makes the faulty 
output of G = 1 is given by (.4 + B)-(D + F) = A-D + B-D 
+ A ■ F + B ■ F. Examination of the terms of this equation reveals 
AD = B-D = A-F = 0. Term A-D = because, if it were not 
zero, then there would be some term in AD that could set 
G = 1 and G = simultaneously. This is clearly impossible. Similarly, 
B-D 5* (A-F 5* 0) implies that in the presence (absence) of the 
fault, there is some term in B-D(A-F) that can set 6' = 1 and G = 
simultaneously. Therefore, any term that can set G = in the presence 
of the fault and G = 1 in the absence of the fault must be in BF. 

For the case in which k — 1, the test must be a term of (D + E) 
■ (A + C) = DA + DC + EA + E-C. By similar analysis, AD 
= D-C = A-E = 0. Therefore, a term that sets G = 1 in the presence 
of the fault and G = in the absence of the fault must be in E-C. 

Since the problem is to detect fault x.i without regard to the output 
value of G, any term in BF + E-C is a valid test. Therefore, all 
tests to detect fault x.i at gate G can be expressed as 

Detection Tests = BF + E-C. 

If BF + E-C — 0, there is no test that will detect fault x.i at gate G. 
It is then necessary to examine each remaining circuit output to 
determine if x.i is detectable. If x.i is not detectable at any circuit 
output, then there exists no test to detect x.i for the sequence length 
specified. 

Clearly, this algorithm generates every test that will detect fault 
x.i at each output. Since it is probably necessary to detect the fault 
only once, the first valid test found usually terminates the process. 

4.2 The maximum-cover strategy 

The maximum-cover strategy has been quite successful. In most 
cases, it has detected from 85 to 100 percent of the faults in the circuit 
that are detectable with the maximum sequence length specified. For 
highly sequential circuits, a short-maximum-sequence length may 
detect few faults because the circuit cannot be exercised completely 
without using a long sequence of input vectors. 

The maximum-cover strategy operates on the fault-free equations 
derived for the circuit according to the maximum sequence length 
specified. The basic idea is simply to attempt to detect each primary 
circuit input fault at each circuit output. Factoring the output equa- 
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tions as before yields : 

F° = A +B-tfj + C-a?j 
pi = D + E-a>j + F-aPj, 

where A, B, C, D, E, and F are sum-of-product terms. This case 
attempts to detect the input faults on a at the output F. A test is 
formed in a manner similar to that used for detecting faults, except 
that it is necessary here to specify the value to be assigned to input 
lead a.j. 

Maximum-Cover Test = (E-C + F-B) • (a l j + a°j). 

This process is repeated until an attempt has been made to test each 
circuit input fault at each output lead. This scheme actually produces 
every test that satisfies the above equation. The shortest test (fewest 
input leads set to logical or 1) is selected in each case. 

The time spent performing this computation is usually much less 
than that required to derive the equations. Also the time and results 
of the maximum-cover operation must be weighed against the cost of 
detecting additional faults on a one-at-a-time basis. Thus, while 
maximum cover is an expensive heuristic (when compared to, say, 
random-number test generation), it provides a set of tests that is 
usually good enough so that one can economically attack the remaining 
faults on a one-at-a-time basis. As a general rule, about 5 to 10 faults 
can be detected using the one-at-a-time strategies for the same cost 
as one pass of the maximum-cover strategy which inherently tries to 
detect all faults. 

V. EXPERIMENTAL RESULTS 

The final measure of an automatic test generation system is how 
well it does its job on real circuits. The ATG system has been pro- 
grammed and is being used at several locations in Bell Laboratories. 
The algorithms presented here are generally not useful for hand com- 
putation. The version of ATG used by Bell Laboratories on the IBM 
360, Model 67, collects certain data each time it runs successfully. 
The data collected include the execution CPU time, number of test 
vectors generated, number of faults detected, number of gates in the 
circuit, and number of flip-flops in the circuit. 

This implementation of ATG requires about 100,000 bytes for 
program storage. Other storage, used during execution, depends on the 
characteristics of the circuit being run. As the equations get longer, 
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the storage requirements increase. Generally speaking, ATG requires 
from one to five megabytes of virtual storage. This implementation 
allows only unit- and zero-gate delays, handles single stuck-at-one and 
stuck-at-zero faults, and generates fault-detection tests for single faults 
as well as the maximum-cover test-generation strategy. 

The data that have been collected indicate that ATG has been 
primarily used to generate tests via the maximum-cover strategy. In a 
few uses of ATG, the user attempted to detect only specified faults; 
these data are not included in this paper. 

The data collected represent only successful ATG runs. If the 
same circuit was run several times, then only the run that produced 
the fewest undetected faults (e.g., used the longest sequence length) 
is included. This is consistent with the recommended operational 
procedure, which starts with a short sequence length and increases it 
until an acceptable level of fault detection is reached. Faults in unused 
gates are included both in the undetected faults and in the total 
number of faults in the circuit. 

The results of 300 ATG runs on 120 circuits using the maximum- 
cover strategy are summarized in Figs. 11 through 15. The average 
circuit contained about 270 gates including about 10 flip-flops in the 
sequential circuits. Thirty-two circuits were combinational. ATG 
produced an average of 94 vectors in an average of 43 seconds of 
IBM 360, Model 67, CPU time resulting in an average detection level 
of 88 percent of the total number of faults in the circuit. However, 
the median percentage of undetected faults was only 7 to 8 percent. 
The longest sequence length used for these circuits was 5. Unfortu- 
nately, there is almost no correlation between the five parameters 
plotted in Figs. 11 through 15. The data correlate only in the extreme 
cases. For example, the circuit with 32 flip-flops produced a large 
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600 



percentage of undetected faults. For most of the data, none of the 
parameters correlates significantly. 

ATG did not produce acceptable results on all circuits. In general, 
ATG is limited by the length of the equations generated. As these 
equations become long, the execution time increases and ATG may 
not terminate successfully due to excessive run time and/or storage 
requirements. The equations can become long as a result of long 
sequence lengths (e.g., shift registers and counters) or as a result of 
the function of the logic circuit (e.g., parity trees and adders). In 
addition, circuits such as parity trees produce quite long equations 
and ATG generates more vectors than the minimum required. 

One circuit recently run on ATG using the maximum cover strategy 
is worthy of special mention. The circuit is a 1000-gate, 11-state 
sequencer plus input, output, and transition logic. The sequencer 
state, represented by four D-flip-flops, can be read and written from 
circuit outputs and inputs respectively. Extensive use is made of the 
system clock to control transitions and gating. The clock waveforms 
were supplied to ATG by the user. ATG, using the clock and sequences 
of length one, generated 770 vectors in about 800 seconds, detecting 
about 95 percent of the faults in the circuit. The success of ATG here 
is partially due to the "easily testable design" which allows the 
sequencer state to be directly read and written. 

In practice, while ATG will not efficiently handle all circuits, it 
appears to be an economical tool for automatic test generation for 
"mildly" sequential circuits containing around 500 gates. The design 
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of circuits in an "easily testable" manner greatly eases the work 
required to automatically generate test vectors for the circuit. 

VI. SUMMARY AND CONCLUSION 

In summary, the method used to generate tests is as follows : 

(i) Set the maximum sequence length k = 1. 

(ii) Generate equations for the logic circuit with sequence length k. 

(Hi) Generate tests using maximum-cover strategy. 

(iv) Simulate the tests. If the percentage of undetected faults is 

less than, say, 10 percent, proceed to step (v). Otherwise, set 

k = k + 1 and return to step (ii). 

(v) Generate tests for remaining undetected faults (one fault at 

a time) detectable with sequence length k. 
(vi) If an acceptable percentage of undetected faults remains, stop. 
Otherwise, set A; = k + 1 and return to step (v). 

In practice, most users of ATG have been satisfied with the ATG 
results without trying steps (v) or (vi). 

The algorithms treat a logic network as an interconnection of gates 
which are assigned some fixed time delay. The technique generates 
two equations, F°(t) and F^t), for each gate in the circuit. These 
equations denote the input conditions required to set gate F to logical 
and 1 respectively at time t. Because the technique starts from the 
circuit inputs and proceeds forward through the circuit (like the 
signal flow), it is not necessary to identify feedback leads. Therefore, 
both combinational and sequential circuits can be handled by the 
same algorithm. 

The primary difference between combinational and sequential- 
circuit test generation is that several input vectors may be required 
in a sequential circuit to set the desired state, detect some fault, and 
then propagate the fault to some output lead. The number of input 
vectors required to perform some test on the circuit is called the 
sequence length of the test. A sequence length of one is sufficient to 
generate all tests for a combinational circuit since it has no memory. 
The maximum sequence length to be considered is supplied by the user. 

The test-generation algorithms first generate the equations for the 
circuit, taking into consideration the gate delays and the maximum 
sequence length specified. These equations also take into account the 
effect of various single stuck-at-one, stuck-at-zero, or open-gate input 
faults when tests are being generated for specific faults. Then, from 
these equations, the algorithms will generate a test for any of the 
above faults if such a test exists within the sequence length specified. 

1502 THE BELL SYSTEM TECHNICAL JOURNAL, OCTOBER 1974 



Equations may also be generated that represent only the fault-free 
circuit. It is then possible to generate tests from these equations which 
exercise the circuit in such a way that many faults are detected. 
This has been a popular feature because it produces good results 
economically. 

These algorithms have been implemented and are currently being 
used to generate tests for circuits containing around 500 gates. Quite 
good results have been produced using the maximum-cover technique. 
A median of 7 to 8 percent undetected stuck-at faults was reached in 
less than 1 minute of IBM 360, Model 67, CPU time on a sample of 
some 120 circuits. Because of the success of the maximum-cover 
techniques, very little use has been made of the "single-fault" 
techniques. 

In conclusion, ATG is a production system that has been found to be 
a valuable tool for the generation of circuit pack tests. 
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